seroval

npm · Package

13 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)CVE-2026-116581 · GHSA-97R2-QH9M-474H	seroval Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9	npmRed Hat	High	Fix reported	2026-10-29
Seroval: Code injection through a typed array's own constructor propertyCVE-2026-116583 · GHSA-F86P-H4J2-7QGJ	seroval Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9	npmRed Hat	Medium	Fix reported	2026-10-29
Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node lengthCVE-2026-116584 · GHSA-WP97-X4HV-QVHP	seroval Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9	npmRed Hat	High	Fix reported	2026-10-29
Seroval: Script injection through RegExp sources in serialized outputCVE-2026-116582 · GHSA-9WX9-5PV9-3349	seroval Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9	npmRed Hat	Medium	Fix reported	2026-10-29
Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type checkCVE-2026-116580 · GHSA-7RV5-MRXV-XCR9	seroval Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9	npmRed Hat	High	Fix reported	2026-10-29
Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)CVE-2026-104846 · GHSA-P6VX-979V-RG4C	seroval Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9	npmRed Hat	Critical	Fix reported	2026-10-06
Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserializationCVE-2026-104845 · GHSA-JP82-F5MQ-HWHP	seroval Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9	npmRed Hat	High	Fix reported	2026-10-06
seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserializationCVE-2026-59940 · GHSA-MV8W-475R-VWQW	seroval	npm	Critical	Fix reported	2026-07-24
seroval affected by Denial of Service via RegExp serializationCVE-2026-23956 · GHSA-HX9M-JF43-8FFR	seroval	npm	High	Fix reported	2026-05-20
seroval Affected by Prototype Pollution via JSON DeserializationCVE-2026-23736 · GHSA-HJ76-42VX-JWP4	seroval	npm	High	Fix reported	2026-02-03
seroval Affected by Remote Code Execution via JSON DeserializationCVE-2026-23737 · GHSA-3RXJ-6CGF-8CFW	seroval	npm	High	Fix reported	2026-02-03
Seroval affected by Denial of Service via Array serializationCVE-2026-23957 · GHSA-66FC-RW6M-C2Q6	seroval	npm	High	Fix reported	2026-02-03
Seroval affected by Denial of Service via Deeply Nested ObjectsCVE-2026-24006 · GHSA-3J22-8QJ3-26MX	seroval	npm	High	Fix reported	2026-02-03